# EIM-TRNG: Obfuscating Deep Neural Network Weights with Encoding-in-Memory True Random Number Generator via RowHammer

arXiv: https://arxiv.org/abs/2507.02206 · HTML: https://mlsanity.com/paper/2507.02206/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 18 of its 47 references that are in the map.
- First posted on arXiv 3 Jul 2025.

## Builds on (most cited first, 18 of 18)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories](https://mlsanity.com/paper/2111.04625/) (2021)
- [EDEN: Enabling Energy-Efficient, High-Performance Deep Neural Network Inference Using Approximate DRAM](https://mlsanity.com/paper/1910.05340/) (2019)
- [TRRespass: Exploiting the Many Sides of Target Row Refresh](https://mlsanity.com/paper/2004.01807/) (2020)
- [MirrorNet: A TEE-Friendly Framework for Secure On-device DNN Inference](https://mlsanity.com/paper/2311.09489/) (2023)
- [QUAC-TRNG: High-Throughput True Random Number Generation Using Quadruple Row Activation in Commodity DRAM Chips](https://mlsanity.com/paper/2105.08955/) (2021)
- [Uncovering In-DRAM RowHammer Protection Mechanisms: A New Methodology, Custom RowHammer Patterns, and Implications](https://mlsanity.com/paper/2110.10603/) (2021)
- [D-RaNGe: Using Commodity DRAM Devices to Generate True Random Numbers with Low Latency and High Throughput](https://mlsanity.com/paper/1808.04286/) (2018)
- [DRAM Bender: An Extensible and Versatile FPGA-based Infrastructure to Easily Test State-of-the-art DRAM Chips](https://mlsanity.com/paper/2211.05838/) (2022)
- [DR-STRaNGe: End-to-End System Design for DRAM-based True Random Number Generators](https://mlsanity.com/paper/2201.01385/) (2022)
- [DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNs](https://mlsanity.com/paper/2305.08034/) (2023)
- [DRAM-Locker: A General-Purpose DRAM Protection Mechanism against Adversarial DNN Weight Attacks](https://mlsanity.com/paper/2312.09027/) (2023)
- [TBNet: A Neural Architectural Defense Framework Facilitating DNN Model Protection in Trusted Execution Environments](https://mlsanity.com/paper/2405.03974/) (2024)
- [Exploiting DRAM Latency Variations for Generating True Random Numbers](https://mlsanity.com/paper/1808.02068/) (2018)
- [Threshold Breaker: Can Counter-Based RowHammer Prevention Mechanisms Truly Safeguard DRAM?](https://mlsanity.com/paper/2311.16460/) (2023)
- [Compromising the Intelligence of Modern DNNs: On the Effectiveness of Targeted RowPress](https://mlsanity.com/paper/2412.02156/) (2024)
- [Understanding RowHammer Under Reduced Refresh Latency: Experimental Analysis of Real DRAM Chips and Implications on Future Solutions](https://mlsanity.com/paper/2502.11745/) (2025)
- [Chronus: Understanding and Securing the Cutting-Edge Industry Solutions to DRAM Read Disturbance](https://mlsanity.com/paper/2502.12650/) (2025)

## Abstract (arXiv)

True Random Number Generators (TRNGs) play a fundamental role in hardware security, cryptographic systems, and data protection. In the context of Deep NeuralNetworks (DNNs), safeguarding model parameters, particularly weights, is critical to ensure the integrity, privacy, and intel-lectual property of AI systems. While software-based pseudo-random number generators are widely used, they lack the unpredictability and resilience offered by hardware-based TRNGs. In this work, we propose a novel and robust Encoding-in-Memory TRNG called EIM-TRNG that leverages the inherent physical randomness in DRAM cell behavior, particularly under RowHammer-induced disturbances, for the first time. We demonstrate how the unpredictable bit-flips generated through carefully controlled RowHammer operations can be harnessed as a reliable entropy source. Furthermore, we apply this TRNG framework to secure DNN weight data by encoding via a combination of fixed and unpredictable bit-flips. The encrypted data is later decrypted using a key derived from the probabilistic flip behavior, ensuring both data confidentiality and model authenticity. Our results validate the effectiveness of DRAM-based entropy extraction for robust, low-cost hardware security and offer a promising direction for protecting machine learning models at the hardware level.